Currently, kerberized services do not make use of Pluggable
Authentication Modules (PAM) — kerberized servers bypass PAM
completely. However, applications that use PAM can make use of
Kerberos for authentication if the pam_krb5 module (provided in the pam_krb5 package) is installed. The pam_krb5 package contains sample configuration
files that allow services like login and
gdm to authenticate users as well as
obtain initial credentials using their passwords. If access to
network servers is always performed using kerberized services or
services that use GSS-API, such as IMAP, the network can be
considered reasonably safe.
 |
Tip |
| |
Administrators should be careful to not allow users to
authenticate to most network services using Kerberos passwords.
Many protocols used by these services do not encrypt the password
before sending it over the network, destroying the benefits of the
Kerberos system. For example, users should not be allowed to
authenticate using their Kerberos passwords over Telnet.
|
